All rooms Sign in
WEBLesson + challenge Live machineFree

JWT Mirage

Two algorithms, one key — and the verifier cannot tell the difference.

Two algorithms, one key — and the verifier cannot tell the difference.

Difficulty
Medium
Estimated time
30 min
Points
200 pts
Completions
Be the first to complete it
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • Reading and decoding JWT structure (header, payload, signature) by hand.
  • Spotting an RS256 / HS256 algorithm-confusion flaw in a token verifier.
  • Turning a published RSA public key into an HMAC forging secret.
  • Crafting a signed token with escalated claims using only standard-library crypto.
  • Chaining token forgery into a broken-access-control bypass.

What is inside

  1. Task 1 · JWT Mirage1 question

Sign in to read the tasks, start the machine and answer the questions.